Receive alert 4 hours later



  • Official comment
    Graham Watts

    Hi There - this is likely a timezone issue. If you navigate to your collector management page (Manage Data > Collection) you will need to correct the syslog source's timezone by adjusting it to the timezone of the physical location those syslog messages are being generated in.

    Here is a screenshot for where to adjust:

    I hope this helps, let us know if you have additional questions here.



    Comment actions Permalink
  • Avatar
    Anil Baradia

    Even I am facing the same problem regarding time lag even after time zone modification. It is taking 20-30 minutes to reflect the logs in the dashboard. Is this time can be reducible?

    Comment actions Permalink
  • Avatar
    Graham Watts

    Hey Anil,

    There are many reasons data might be delayed getting to Sumo Logic. What type of log is this?

    Here's a query you can try to see the difference between when the event was generated and when we received it:


    | ((_receipttime - _messagetime)/1000)/60 as timediffmins
    | timeslice 5m
    | avg(timediffmins) by _timeslice


    Comment actions Permalink

Please sign in to leave a comment.